HOME | ABOUT US

Streamlining Threat Intelligence: The Role of STIX and TAXII in Cyber Threat Sharing

STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated Exchange of Indicator Information) are technologies developed to improve the detection, analysis, and sharing of cyber threat intelligence.

STIX: is a language used for standardizing the representation of information about cyber threats. It allows different organizations and individuals to represent complex information in a consistent, structured manner, enabling efficient communication, processing, and automation. STIX is composed of multiple components, including:

Indicators: Describes patterns of suspicious or malicious activity.
Observables: Specific pieces of information or data points such as IP addresses or file hashes.
Incidents: Represents specific instances of security events.
TTPs (Tactics, Techniques, and Procedures): Describes the behavior and modus operandi of threats.
Campaigns: Represents sets of related malicious activities or incidents.
Threat Actors: Information about groups or individuals involved in malicious activity.
Exploit Targets: Details about vulnerabilities or weaknesses being targeted.

TAXII: is a protocol used to exchange cyber threat information represented in STIX. TAXII allows the communication and sharing of threat intelligence across different organizations and systems in a secure and automated manner. TAXII defines several services that support the exchange of threat intelligence information, such as:

Collection Management Service: Manages the collections of STIX content available to TAXII clients.
Inbox Service: Receives STIX content submitted by TAXII clients.
Discovery Service: Allows TAXII clients to locate services provided by a TAXII server.
Poll Service: Enables clients to request STIX content from a server.

The development and evolution: STIX and TAXII were initially developed by MITRE Corporation, sponsored by the United States Department of Homeland Security (DHS) under the Office of Cybersecurity and Communications

In 2015, the development and management of STIX and TAXII were transitioned to OASIS (Organization for the Advancement of Structured Information Standards) which is a non-profit consortium that drives the development, convergence, and adoption of open standards for the global information society. Given its expertise and experience in developing and managing open standards, this move was aimed at ensuring broader international participation in the development and evolution of these standards
However the evolution of these standards has been influenced by contributions from a wide range of organizations and individuals, including government agencies, private companies, and research institutions. They have collaborated through OASIS to define and refine the standards to meet the evolving needs of the cybersecurity community.

The main purpose of STIX and TAXII: is to facilitate the exchange of threat intelligence between different entities, such as cybersecurity vendors, organizations, and government agencies, enabling them to respond more effectively to cyber threats. The standardization and automation provided by these technologies allow for faster and more efficient identification, analysis, and mitigation of cyber threats.

Without standards and protocols like STIX and TAXII for structuring and sharing cyber threat intelligence, several challenges and inefficiencies would arise in the field of cybersecurity. Here’s a look at some of the implications of not having these or equivalent standards:

Lack of Uniformity: Without a standardized format, organizations would use varied, unstructured formats for documenting and sharing threat intelligence, leading to inconsistencies and misunderstandings.
Inefficient Communication: Different organizations would struggle to exchange threat intelligence due to incompatible formats, hindering the flow of critical information between entities. This could delay the dissemination of crucial threat information and consequently, the deployment of protective measures.
Limited Automation: Lack of standardization would restrict the automation of threat intelligence processing and analysis, making the process more time-consuming and prone to errors.
Decreased Collaboration: Organizations would find it challenging to collaborate on cybersecurity issues due to the complexities in interpreting and correlating diverse, unstructured data formats.
Impaired Threat Detection and Response: The absence of effective and timely sharing of threat intelligence would compromise the ability of organizations to detect and respond to emerging threats, potentially resulting in increased successful cyber-attacks and data breaches.
Reduced Situational Awareness: Organizations would have a less comprehensive understanding of the cyber threat landscape, leading to suboptimal security postures and strategies.
Higher Costs: Organizations would need to invest more resources in manually processing, analyzing, and correlating threat intelligence, leading to increased operational costs.

STIX and TAXII offer a broad range of applications across various domains of cybersecurity. Here are several additional use cases for these technologies:

Threat Intelligence Platforms (TIPs): leverage STIX and TAXII for ingesting and disseminating structured threat intelligence, making it easier to aggregate, correlate, and analyze information from multiple sources.
Information Sharing and Analysis Centers (ISACs) and Organizations (ISAOs): ISACs and ISAOs use STIX and TAXII to share threat intelligence among their members, enhancing collective security and situational awareness across industries and communities.
Vulnerability Management: Organizations can utilize STIX-formatted data to enrich their vulnerability management processes, correlating vulnerabilities with active threats and exposures to prioritize remediation efforts effectively.
Security Policy Enforcement: Security devices like firewalls and intrusion prevention systems can use TAXII to receive STIX-based threat intelligence feeds to enforce security policies dynamically, such as blocking malicious IPs or URLs.
Endpoint Detection and Response (EDR): EDR solutions can leverage STIX to enhance detection capabilities and provide more context around endpoint-related incidents, aiding in quicker and more informed response actions.
Incident Management: Incident management systems can leverage STIX and TAXII to integrate and correlate incident data with threat intelligence, providing richer context and aiding in quicker resolution of incidents.
Digital Forensics and Incident Response (DFIR): DFIR teams can use STIX-formatted intelligence to enrich forensic investigations, understand attack patterns, identify compromised entities, and gather evidence.
Fraud Prevention: Financial institutions and e-commerce platforms can utilize STIX and TAXII to share information about fraudulent activities, enhancing their ability to detect and prevent fraud.
Security Research and Analysis: Security researchers and analysts use STIX to structure their findings and analyses, making it easier to share, compare, and validate research within the cybersecurity community.
Cyber Threat Hunting: Proactive threat hunters can leverage STIX to structure and share indicators and patterns of compromise, aiding in the identification of sophisticated, previously undetected threats.
Regulatory Compliance: Organizations required to share threat intelligence as part of compliance mandates can leverage STIX and TAXII to standardize and automate the sharing of compliance-related information.
Risk Management: Enterprises can utilize STIX to integrate threat intelligence into their risk management frameworks, enabling more accurate assessments of cybersecurity risks and informed decision-making.
Education and Training: STIX can be used in educational materials and cybersecurity training programs to teach students and professionals about threat intelligence concepts, structures, and applications in a standardized manner.
Supply Chain Security: Organizations can use STIX and TAXII to share intelligence related to supply chain threats, helping to identify and mitigate risks related to suppliers and service providers.
Integration with SIEM and SOAR solutions: The structured and rich context provided by STIX enhances the ability of SIEM and SOAR solutions to detect advanced and sophisticated threats in the evolving cyber landscape.

The use of STIX and TAXII extends across multiple cybersecurity domains, enhancing the efficiency, collaboration, and effectiveness of various cybersecurity processes and solutions. These standards facilitate a unified and structured approach to sharing, analyzing, and applying threat intelligence, thus empowering organizations and communities to build a more resilient cybersecurity ecosystem.

STIX and TAXII are not services that one can subscribe to but rather are open standards and protocols that enable the sharing of cyber threat intelligence. However, you can subscribe to threat intelligence feeds that utilize STIX and TAXII protocols to distribute threat intelligence.

HOME | ABOUT US

Why Firewall sizing requires more than just counting users

When it comes to safeguarding your organization's network, firewalls or a next-generation firewall (NGFW) play a crucial role as the first line of defense against cyber threats. However, sizing a firewall solely based on the number of users is a common mistake that can lead to inadequate protection and potential security vulnerabilities..

Understanding the Limitations of User Count

While the number of users on your network is undoubtedly an important factor, it does not provide a complete picture of your organization's security needs. User count alone fails to consider various critical aspects that influence the volume and types of traffic traversing the firewall. For instance:

Traffic Patterns: Different users may have varying levels of network activity. Some may generate substantial data traffic due to multimedia streaming or file sharing, while others may only use minimal bandwidth for email and basic browsing.
Applications and Services: Each user's needs may differ based on the applications and services they access. Video conferencing, cloud services, and virtual private network (VPN) connections all have unique security requirements that must be accommodated in the firewall sizing.
Threat Landscape: Cyber threats are continuously evolving, and the number of users does not directly correlate with the level of risk your organization faces. A properly sized firewall must be equipped to handle the latest security threats and provide proactive protection.
Remote Access: If your organization has remote workers or satellite offices, you need to account for additional connections and ensure secure access through the firewall.

Comprehensive Firewall Sizing Factors

In this article, we'll explore why user count alone wouldn’t suffice for firewall sizing, and here are the critical factors or parameters you should to ensure your firewall is appropriately sized.

Network Throughput and Traffic Patterns:-Understanding your network's throughput and traffic patterns is crucial for accurate firewall sizing. Measure the volume of data that passes through your network regularly, and identify peak usage times. Analyze the types of traffic (e.g., web browsing, video streaming, file transfers) to determine the most bandwidth-intensive applications. This data will help you identify potential bottlenecks and ensure your firewall can handle the network's peak demands effectively.
Applications and Services:-Take into account the applications and services used within your organization. Some applications may require specific port configurations or advanced security features to function properly. Additionally, cloud-based applications and Software-as-a-Service (SaaS) solutions may require direct access to the Internet, necessitating careful consideration of security measures and user access policies.
VPN and Remote Access Usage:-If your organization relies heavily on remote access and virtual private networks (VPNs), it's essential to factor in the increased load on the firewall. Remote workers, branch offices, and mobile devices accessing the network remotely can significantly impact firewall performance. Ensure your firewall can handle the additional VPN connections and provide secure access to remote users.
Threat Prevention Capabilities:-Modern firewalls often come with advanced threat prevention features, such as intrusion detection and prevention systems (IDPS), antivirus, and content filtering. These features require additional processing power and memory. Evaluate your organization's security needs and choose a firewall that can deliver robust threat prevention without compromising performance.
Scalability and Future Growth:- A firewall is a long-term investment, and your organization is likely to grow over time. Choose a firewall solution that offers scalability to accommodate future expansion without the need for frequent upgrades. Scalability ensures your firewall can adapt to changing network requirements and maintain its effectiveness in the face of increasing traffic.
Redundancy and High Availability:-High availability is critical for continuous network protection. Implementing a redundant firewall configuration or utilizing clustering technology ensures that even if one firewall fails, the backup takes over seamlessly, preventing any interruptions in your network security.
Bandwidth Support:- To properly size your firewall, you need to accurately measure your organization's bandwidth requirements. Understanding the total bandwidth available to your network is essential, as well as identifying any potential bottlenecks or high-traffic periods. This information helps you choose a firewall that can handle the network's peak demands without compromising performance.Additionally, consider the direction of traffic flow (i.e., inbound and outbound). In some scenarios, outbound traffic might be higher than inbound traffic due to cloud-based services or data backups. Ensuring balanced support for both inbound and outbound traffic is crucial for maintaining efficient network operations.
Type and Number of Ports:- The type and number of ports on a firewall directly impact its capacity to handle different types of traffic and the complexity of your network architecture. Ensure the firewall you choose has sufficient ports and the right port types to accommodate your organization's specific networking requirements.

Ports serve as interfaces through which network devices and services connect to the firewall. Different types of ports support specific functions and protocols, and the availability of the right ports is vital for accommodating various network connections and services. Some important considerations related to the type and number of ports include:

- Ethernet Ports: Ethernet ports are essential for connecting local area network (LAN) devices to the firewall. The number of Ethernet ports determines how many devices can directly connect to the firewall, such as computers, switches, or routers.
- WAN Ports: Wide area network (WAN) ports enable the connection to external networks, such as the internet or other remote offices. The number of WAN ports determines the number of external connections the firewall can support.
- DMZ Ports: A demilitarized zone (DMZ) is a semi-isolated network segment that hosts public-facing services, such as web servers or email servers. Having dedicated DMZ ports allows you to securely deploy and manage these services separately from your internal network.
- Specialized Ports: Some firewalls may include specialized ports for specific functions, such as VPN ports for secure remote access or console ports for management purposes.
- Port Speed: Consider the speed (e.g., 1Gbps, 10Gbps) of the ports, as it affects the overall throughput and data transfer capabilities of the firewall.

Moreover, consider the potential need for expansion in the future. If your organization expects to add more network devices or connect to additional external networks, selecting a firewall with available expansion slots or modular port options can provide flexibility and scalability.

By carefully evaluating the type and number of ports on the firewall, you can ensure seamless connectivity and optimal network security, allowing your organization to efficiently handle diverse networking needs.

HOME | ABOUT US

Firewalls on High Availability(HA) : Benefits and Challenges

Customers usually choose to go for two firewalls in high availability (HA) mode for several reasons, including:

Redundancy: The primary reason for configuring two firewalls in high availability mode is to ensure redundancy. If one firewall fails, the other firewall takes over seamlessly, ensuring continuous protection for the network.
Business continuity: High-availability firewalls are essential for businesses that require uninterrupted access to their applications and data. By having two firewalls in high availability mode, businesses can ensure that their network is always protected and that they can continue to operate even if one of the firewalls fails.
Load balancing: Some customers also use two firewalls in high availability mode to balance the traffic load between them. This can be useful in situations where one firewall may be under heavy load due to a large amount of traffic, ensuring that the network is not overwhelmed.
Security: High availability firewalls can also enhance the overall security posture of an organization. By having two firewalls, customers can implement different security policies on each firewall and ensure that their network is protected from various threats.
Compliance: Certain regulatory requirements, such as those set forth by the Payment Card Industry Data Security Standard (PCI DSS), mandate the use of high-availability firewalls as a security control to protect cardholder data. Customers may choose to implement high-availability firewalls to comply with such requirements.

Configuring firewalls for high availability (HA) involves setting up redundant firewall devices to ensure continuous protection and access control in the event of a failure. Here are some steps, in general, to configure firewalls for high availability:

Choose the appropriate firewall devices: Select two or more identical firewall devices that support high availability configuration.
Configure basic settings: Configure the basic settings on each firewall device, including hostname, IP address, and network interfaces. Ensure that each firewall device is connected to the same LAN segment.
Configure HA settings: Configure HA settings such as heartbeat interfaces, failover settings, and synchronization settings. The heartbeat interface is used to detect the health status of the other firewall device. Failover settings determine how the devices switch roles in the event of a failure, and synchronization settings ensure that the configuration data is identical on both devices.
Test the failover process: Test the failover process by simulating a failure on the active firewall device. Verify that the standby firewall device takes over the role of the active firewall device.
Configure the firewall rules: Configure the firewall rules on both devices to allow the desired traffic to pass through. Ensure that the rules are synchronized between both devices.
Monitor the devices: Monitor the firewall devices and ensure that both devices are functioning correctly.

However, the above steps may vary depending on the firewall devices & the makes being used, and the configuration requirements. It is always best to consult the manufacturer’s documentation for detailed instructions on configuring firewalls for high availability. But Before configuring firewalls for high availability (HA), it is crucial to ensure that certain prerequisites as mentioned below are in place.

Hardware requirements: Check the hardware requirements of the firewall devices to ensure they are suitable for high availability configuration. The hardware should be able to handle the expected traffic load and have the necessary interfaces and storage for the configuration and log data.
Network infrastructure: Ensure that the network infrastructure is configured correctly to support high availability. The firewall devices should be connected to the same LAN segment and have a dedicated heartbeat interface for the failover mechanism.
Firewall software: Check that the firmware or software on the firewall devices is compatible with the high availability configuration. Upgrade the firmware or software if necessary.
IP addressing: Ensure that each firewall device has a unique IP address and that the IP addresses of the interfaces on each device are on the same subnet. It is also important to ensure that the default gateway is correctly set up.
Firewall rules: Ensure that the firewall rules are configured correctly and tested before configuring high availability. This helps to ensure that the firewall rules will be synchronized correctly between the devices.
Documentation: Ensure that you have the necessary documentation, such as the manufacturer’s guide, to guide you through the process of configuring high availability for your specific firewall devices.

It’s highly recommended that you have 2 Switches also while we configure 2 Firewall alliances on HA in order to prevent a single point of failure scenario since if one switch fails, the other switch can continue to provide connectivity to the firewall devices which ensures that there is no disruption to network traffic and that the firewall devices can continue to function even if one switch fails.

Here are a few steps to follow but it’s also important to consult the manufacturer’s documentation for specific instructions on configuring high availability for your particular switch model.

Two switches: Two switches are required for redundancy, and they should be identical in model and configuration to ensure seamless failover.
Power supply units (PSUs): Each switch should have dual power supplies for redundancy, and each power supply should be connected to an independent power source.
Network cables: You will need Ethernet cables to connect the switches to the firewall devices and other network devices.
Spanning Tree Protocol (STP): STP is a protocol used to prevent loops in network topology, and it should be enabled on both switches.
Link aggregation (LAG): LAG, also known as port-channeling or NIC teaming, is used to combine multiple physical links into a single logical link to increase bandwidth and provide redundancy. LAG should be configured between the two switches to ensure redundancy.
IP addressing: Each switch should be assigned a unique IP address on the management network, and the switches should be configured to communicate with each other using the same management network.
Management Software: The management software for the switches should be installed and configured for high availability.
Testing plan: A testing plan should be developed to verify the failover mechanism and ensure that the redundancy configuration is working as intended.

Now let’s look at two commonly used modes of HA:- “Active-Active” and “Active-Passive”, the differences between the two scenarios are as mentioned below:

Active-Active HA: In an active/active HA configuration, both firewalls are actively processing traffic at the same time. Traffic is distributed between the firewalls in a load-balancing fashion, and both firewalls are processing traffic simultaneously. This mode can help increase network throughput and improve performance, especially in scenarios where one firewall may be overwhelmed with traffic.
Active-Passive HA: In an active/passive HA configuration, one firewall is active, processing traffic and handling network requests, while the other firewall is in standby mode, ready to take over if the active firewall fails. This mode provides a higher level of redundancy, as there is always a backup device ready to take over in case of a failure.

In summary, active-/active HA allows both firewalls to actively process traffic simultaneously, while active-passive HA provides redundancy with one active firewall processing traffic and the other standby in case of failure. The configuration of both modes is quite different and it is essential to ensure that the configuration is done correctly to avoid issues such as traffic imbalance or failover failures. Firewall vendors often provide guidance and documentation on how to set up high availability for their devices, and it is recommended to follow these guidelines closely.

Implementing high availability (HA) for firewalls can provide significant benefits in terms of network uptime, reliability, and redundancy. However, there are also several challenges that organizations may face when implementing HA for their firewall infrastructure. Some of these challenges include:

Increased Complexity: Implementing HA for firewalls can add complexity to the network infrastructure. This is because HA typically involves the configuration of multiple devices and protocols, and may require changes to network topology, addressing, and routing.
Cost: HA typically requires the purchase of additional hardware and licenses, which can add to the overall cost of the firewall infrastructure.
Configuration Management: Maintaining consistent configurations across multiple firewall devices can be challenging. Changes made to one firewall must be replicated to all other devices to ensure consistency, and this can be time-consuming and error-prone.
Testing and Maintenance: HA requires regular testing and maintenance to ensure that failover and other processes are functioning correctly. This can be time-consuming and may require additional resources to manage.
Risk of Configuration Errors: If not configured correctly, HA can introduce new points of failure into the network infrastructure. Configuration errors can cause traffic imbalances, failover failures, and other issues that can impact network uptime and performance.
Impact on Performance: HA can impact network performance, especially in active/active mode. The load-balancing process can introduce latency and slow down traffic, especially in scenarios where one firewall is overwhelmed with traffic.

Therefore Organizations should carefully consider the costs and complexity of HA, and ensure that they have the resources and expertise to manage and maintain the HA configuration properly. Additionally, regular testing and maintenance should be performed to identify and resolve any issues that may arise.

Want to know how our solutions can help your business?

SCHEDULE AN APPOINTMENT